fix(coverage-evidence): materialize uv.lock-only repos so their offline coverage can run - #668
Conversation
|
Warning Review limit reached
Next review available in: 5 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthrough검증된 base 커밋에서 Changesuv.lock materialization
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant BaseCommit
participant Materializer
participant TempDirectory
participant uv
participant Manifest
Materializer->>BaseCommit: uv.lock과 pyproject.toml 조회
BaseCommit-->>Materializer: 파일 내용 반환
Materializer->>TempDirectory: 파일 복원
Materializer->>uv: frozen·offline export 실행
uv-->>Materializer: 해시 고정 requirements 반환
Materializer->>Manifest: materialized uv.lock 기록
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
seonghobae
changed the title
seonghobae
changed the title
Correction: drop the model-pool widening from this PR — it is counterproductive given #624I filed the "widen the free reviewer model pool" part of this PR (append
Recommendation: drop commit
I could not push the branch revision myself this session (the environment's Also worth a look while here: this PR's merge is refused with Generated by Claude Code |
Dedup update: two of this PR's three components are now superseded — reduce to the uv.lock materializer onlyRe-checking the open PR set shows the provider-outage (#624) is being fixed correctly elsewhere, which supersedes most of this PR:
Recommendation: rebase this branch down to component 1 (uv.lock materializer) only, or split it into a fresh uv.lock-only PR, and let #672/#674/#675/#678 own the provider + preflight-resilience fixes. I can't do the rebase from this session (environment Note for the pool fix: #678's approach (bot-authored PR so a non-pusher OpenCode App review can satisfy ruleset Generated by Claude Code |
|
Status update — the pipeline deadlock this PR was fighting is now resolved upstream. #678 merged to Disposition of this PR's three components against current
Because #678 rewrote the exact Generated by Claude Code |
e8649ad to
eace3df
Compare
seonghobae
changed the title
|
From the failing run (30584655800) status step env:
This is not fixable from this PR. The remaining blocker is org-side provisioning of a working reviewer provider — most likely the Generated by Claude Code |
… can run The central coverage-evidence sandbox installs the hash-pinned Python locks the materializer extracts from the PR base commit, then runs each repo's `pytest tests` offline. Repositories managed entirely by uv expose only a `uv.lock` (no `requirements*.txt` / `requirements.lock`), so the content-based discovery from #657 finds nothing, no dependencies install, and the suite fails at import (`ModuleNotFoundError`). coverage-evidence then reports `failure` and OpenCode posts a deterministic REQUEST_CHANGES, permanently blocking every uv-managed repo's PR queue even when the repo's own CI is green. Observed on newsdom-api#464 and pg-llm-batch#17. Fix: when a base `uv.lock` is discovered, reconstruct it and its sibling `pyproject.toml` from the exact validated base SHA in an isolated temp dir and run `uv export --frozen --no-emit-project` to produce a fully hash-pinned dependency closure the existing #661 installer consumes like any other lock. `--frozen` forbids lock mutation and network resolution, and both inputs are read only from the base commit, so no PR-mutable content reaches uv and the trust boundary is unchanged. It is best-effort: if `uv` is absent, the base `pyproject.toml` is missing, the export fails, or its output is not fully hash-pinned, the lock is skipped exactly as before, so this can never break an otherwise-working build. Flat-layout and requirements-based repos are unaffected. Verification (against the real newsdom-api base tree): `uv.lock` -> `requirements-000.txt` with 225 `--hash=` pins. Full suite: 710 passed; scripts/ci line coverage 100% (materializer 114/114); interrogate 100%. Scope: this covers uv.lock-only repos on runners where `uv` is available (GitHub's ubuntu-latest ships it). Native-extension repos that need a maturin build of a compiled module (e.g. fast-mlsirm's `_core`) remain a separate, harder gap and are not addressed here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HdCssGnNMhKHNu3TXFstWH
eace3df to
eb85631
Compare
|
Current-head refresh (2026-08-01 UTC): force-with-lease rebased the existing single-component fix onto central Live reproduction from fast-mlsirm #380’s exact base
Focused current-head validation:
No new implementation was created; this preserves and refreshes the existing #668 fix. |
|
Current-head audit found that the implementation and test described |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ci/materialize_base_python_requirements.py`:
- Around line 109-149: Update _export_uv_lock around the _run_uv_export call to
catch FileNotFoundError and subprocess.TimeoutExpired, returning None for either
failure. Preserve the existing nonzero-return and hash-pinning checks so
transient uv availability or timeout failures fall back to the documented no-uv
behavior without propagating to base_hash_locks.
- Around line 82-107: Update _run_uv_export to accept the uv executable path
supplied by its caller and use that resolved path instead of the literal "uv";
add a finite subprocess.run timeout so a hung export returns control to the
best-effort skip logic. Preserve the existing export arguments, and update
_export_uv_lock plus test_run_uv_export_invokes_uv_with_frozen_offline_flags to
pass and assert the resolved path and timeout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: dd891e5c-6ee4-4105-bc8c-c9b3160cb41f
📒 Files selected for processing (2)
scripts/ci/materialize_base_python_requirements.pytests/test_materialize_base_python_requirements.py
|
Addressed both current-head CodeRabbit findings in ad8322e: |
|
Current-head validation for
The previous OpenCode run targeted superseded head |
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["CI script: materialize_base_python_requirements.py"]
S1 --> I1["review and security gate shell path"]
I1 --> R1["Review risk: CI script: materialize_base_python_requirements.py"]
R1 --> V1["bash -n plus Strix self-test"]
Evidence --> S2["Test: test_materialize_base_python_requirements.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_materialize_base_python_requirements.py"]
R2 --> V2["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: evidence affirmatively supports PR intent — scripts/ci/materialize_base_python_requirements.py now exports base uv.lock into hash-pinned closures so uv.lock-only repos can run offline coverage. Verification posture: focused hunks plus CodeGraph verbatim source trace inspected; direct PR-head file reads were denied by sandbox rules, so inlined CodeGraph source and focused hunks were used (source limitation, not a repository fact). Linter/static: no lint evidence supplied this run; not a blocker for this CLI-only diff. TDD/regression: tests/test_materialize_base_python_requirements.py adds skip-non-blob, happy uv export, uv absent, pyproject absent, export failure, and unpinned-output rejection. Coverage: Coverage execution evidence Result PASS — supported repository test suites passed. Docstring coverage: configured repository docstring gates passed or docstring coverage was advisory per Coverage execution evidence. DAG: base-to-head flowchart base_hash_locks -> _export_uv_lock -> _run_uv_export -> materialize -> offline coverage, reflecting head flow. PoC/execution: no OPENCODE_EXECUTION_RECEIPT present; verification rests on CodeGraph source trace, focused diff, and Coverage execution evidence PASS. DDD/domain: CI coverage-evidence domain; no domain model change. CDD/context: single-purpose materializer component, PR narrowed from three components to the uv.lock export path. Similar issues: consistent with prior base-lock trust commits (#644/#657/#661). Claim/concept check: 'uv export --frozen --offline --no-emit-project --no-editable' and 'no PR-mutable content reaches uv' confirmed from source trace (base SHA reads only). Standards search: no external standard dependency. Compatibility/convention: new identifiers _run_uv_export, _export_uv_lock, UV_EXPORT_TIMEOUT_SECONDS are multi-word idiomatic snake/SCREAMING case; no single-word or reserved names introduced. Breaking-change/backcompat: non-uv repos behave identically; uv.lock-only repos degrade to [] whenever export is unavailable or fails. Implementation completeness: both new functions fully implemented with docstrings; no placeholders. Performance: one bounded (120s) subprocess per uv.lock in an isolated temp dir. Developer experience: CLI interface and ::error:: annotation preserved; no interface churn. User experience: non-web surface — offline coverage gate now obtains installable closures for uv.lock-only repos where it previously materialized nothing. Visual/DOM: non-web change; no DOM/ARIA surface (CLI/CI output contract reviewed instead). Accessibility/i18n: no user-facing UI added; message style unchanged. Supply-chain/license: no new dependencies; stdlib plus runner-provided uv via shutil.which with None-degradation. Packaging: pyproject.toml present (requires-python >=3.10); test contract python3 -m pytest tests. Security/privacy: inputs read exclusively from the validated base commit via git show; uv runs --frozen --offline in an isolated temp dir; exported closure re-gated by _is_hash_pinned; no secrets, auth, or exposed identifiers. Changed files inspected: scripts/ci/materialize_base_python_requirements.py, tests/test_materialize_base_python_requirements.py.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including scripts/ci/materialize_base_python_requirements.py, tests/test_materialize_base_python_requirements.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects scripts/ci/materialize_base_python_requirements.py to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":"scripts/ci/materialize_base_python_requirements.py","line":196,"hypothesis":"A uv.lock or pyproject.toml present only in the PR head, or an unpinned export, could reach uv export and be materialized into the Docker build context, bypassing the base-commit trust boundary and hash-pin guarantee.","attack_or_counterexample":"uv.lock-only base tree with the sibling pyproject.toml absent at base, and uv export output carrying no --hash= lines.","evidence":"Trusted CodeGraph source trace at scripts/ci/materialize_base_python_requirements.py:196 shows locks.append((path, exported)) is reachable only when _export_uv_lock returns non-None, and that function reads both inputs exclusively via _git show {base_sha}:{lock_path}/{base_sha}:{pyproject_path} into a fresh tempfile.TemporaryDirectory while running uv export --frozen --offline; the focused diff shows the missing-pyproject RuntimeError->None and unpinned-output _is_hash_pinned->None branches; tests test_uv_lock_skipped_when_pyproject_is_absent and test_uv_lock_skipped_when_export_is_not_hash_pinned assert materialize(...) == []; Coverage execution evidence reports Result PASS with supported repository test suites passed. source-line-sha256=61f5df3e00348dbcef5c50bee0bcd624b41c8a31f229fd8a03a6fab80308384b","outcome":"falsified"},{"path":"scripts/ci/materialize_base_python_requirements.py","line":11,"hypothesis":"A missing uv binary, a timeout, or any uv export failure crashes the materializer step and breaks previously-working coverage builds for repositories without uv.lock.","attack_or_counterexample":"Run the materializer with shutil.which('uv') returning None, with export exceeding the 120s timeout, and with export exiting non-zero.","evidence":"Trusted focused diff and CodeGraph source trace at scripts/ci/materialize_base_python_requirements.py:11 (module imports shutil, resolved once via shutil.which('uv')) show every failure mode returns None — which-miss, RuntimeError from _git show, except (OSError, subprocess.TimeoutExpired), returncode != 0, and _is_hash_pinned rejection — so base_hash_locks omits the entry and materialize returns [], preserving pre-PR behavior for non-uv repos; tests test_uv_lock_skipped_when_uv_is_unavailable and test_uv_lock_skipped_when_export_fails assert materialize(...) == []; Coverage execution evidence reports Result PASS with supported repository test suites passed. source-line-sha256=582f9ff727d7496ab22b435e59b0f09b8ec415b0c8e8482ad2547f28cb6beb37","outcome":"falsified"}],"residual_risk":"The committed tests mock _run_uv_export/shutil.which, so a real uv export binary execution is not part of the suite; behavior on an actual lock depends on uv semantics for --frozen --offline --no-emit-project --no-editable. The fail-safe None degradation bounds this to the exact uv.lock-only repos the PR targets, and the author-cited live reproduction covers the intended path."}- Result: APPROVE
- Reason: Trust boundary (base-commit-only reads + --frozen --offline + hash-pin regate), full None-degradation fallback, and non-blob entry handling verified; no failed checks, no unresolved threads; coverage and docstring gates pass.
- Head SHA:
ad8322e96a583c81e11058d98310ce947643fb89 - Workflow run: 30690469943
- Workflow attempt: 1
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
2 participants
Rebased onto
mainat9762ebd(post-#678/#674) and narrowed to a single component — theuv.lockmaterializer, which is the only part of the original PR not now superseded (see the disposition table on this PR; #678 landed the Zen reviewer that superseded the model-widening, and #674 superseded the fuzz-lock exclusion). This branch was force-pushed from 4 commits to 1.Problem
The central
coverage-evidencesandbox installs the hash-pinned Python locks the materializer extracts from the PR base commit, then runs each repo'spytest testsoffline. Repositories managed entirely by uv expose only auv.lock, so content-based discovery (from #657) found nothing — no dependencies install, the suite fails at import,coverage-evidencereportsfailure, and OpenCode postsREQUEST_CHANGESon every PR in that repo even when the repo's own CI is green.Confirmed still-unfixed on current
main:scripts/ci/materialize_base_python_requirements.pyonly discovers already-hash-pinned requirement files; it has nouv exportpath. Live impact: keyverse#32/#34/#37, newsdom-api#464, pg-llm-batch#17 are all blocked on this exactcoverage-evidence: failurefor their uv-managedservices/account_unification/ package trees.Fix
When a base
uv.lockis discovered, reconstruct it and its siblingpyproject.tomlfrom the exact validated base SHA in an isolated temp dir and runuv export --frozen --no-emit-project --no-editableto produce a hash-pinned closure the #661 preflight installer consumes like any other lock.--frozenforbids lock mutation and network resolution; both inputs are read only from the base commit; it is best-effort (any failure skips theuv.lockexactly as before, so it cannot break an existing pipeline).Verification (this exact head, in a clean venv with the CI lock)
coverage run -m pytest tests→ 746 passedcoverage report(fail_under=100, sourcescripts/ci) → TOTAL 100%, exit 0interrogate(fail-under=100, excltests) → PASSED 100.0%, exit 0scripts/ci/materialize_base_python_requirements.py(+82/-5) andtests/test_materialize_base_python_requirements.py(+130); no contract-pinned workflow/prose files are changed, so there is zero drift against the fix(governance): finish sweep with Zen review fallback #678 candidate-string/contract updates now onmain.Scope / follow-up
Native-extension repos needing a maturin build of a compiled module (e.g. fast-mlsirm's
_core) remain a separate, harder gap and are intentionally not addressed here.🤖 Generated with Claude Code
https://claude.ai/code/session_01HdCssGnNMhKHNu3TXFstWH
Generated by Claude Code
Summary by CodeRabbit
새 기능
uv.lock을 해시가 고정된 requirements 잠금 파일로 생성합니다.버그 수정
테스트